CVE-2026-11477 json
hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect
published 2026-06-08 5 mo ago modified 2026-07-28 3 mo ago also GHSA-fxr3-gvm4-m8vc , EUVD-2026-35008
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue.
Patch / fix
- github.com/hs-web/hsweb-framework@c288267 commit
- github.com/hs-web/hsweb-framework#355 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/hs-web/hsweb-framework/issues/354 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.hswebframework.web:hsweb-authorization-oauth2 | <=5.0.1 |
no fix listed |
Affected products
- hs-web hsweb-framework
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/hs-web/hsweb-framework/pull/355
issue-tracking, patch, web
-
github.com
/hs-web/hsweb-framework/commit/c2882679a9125cea52678151af5ae213cbd52579
patch, web
-
github.com
/hs-web/hsweb-framework/issues/354
exploit, issue-tracking, web
-
vuldb.com
/vuln/369097
vdb-entry, technical-description, web
-
vuldb.com
/vuln/369097/cti
signature, permissions-required, web
-
vuldb.com
/cve/CVE-2026-11477
third-party-advisory, web
-
vuldb.com
/submit/833962
third-party-advisory, web
-
github.com
/hs-web/hsweb-framework/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-11477
advisory
-
github.com
/hs-web/hsweb-framework
package
Sources
- CVE List CVE-2026-11477
- GitHub Advisory GHSA-fxr3-gvm4-m8vc
- NVD CVE-2026-11477
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.